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REPLY TO 


ATTN OF: Is dD 


sussect, OMB Circular No. A-108 Transmittal Memorandum No. 1 
- Agency Liaison Representatives for Privacy Act Implementation 


Attached for your information is an advance copy of 
Transmittal Memorandum No. 1 to OMB Circular No. A-108 
which establishes the new system reporting reyguirements 
PoEeeane to Section 552a(o) of the Privacy Act. 


This Transmittal Memo will be published in the Federal 
Register within the next few days. 


Loree < ce on 


Walter W. As ew! 
Deputy Associate Director a 

for Information Systems Pe. 
Attachment pas ice a 
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=XECUTIVE OFFICE OF THE PRESIDENT 
CFFICE OF MANAGEMENT AND BUDGET 
WASHINGTON, 0.C. 20503 


Saptember 30, 1975 . CIRCULAR NO. A-198 
: Transmittal Memorandum No. 1 


YO THE HEADS Of EXECUTIVE DEPARTMENTS AND ESTABLISHMENTS 


SUBJECT: Responsibilities for the maintenance of records 
about individuals. by Federal agencies 


J. Purpose. This supplement to OMB Circular A-108 dated 
July 1, T975 provides guidance to Federal agencies regarding 
the preparation and submission of reports of their intention 
to establish or alter systems of personal records as 
required by the Privacy Act of 1974 (P.L. 93-579, 5 U.S.C. 
552a(o)). These procedures supersede preliminary guidance 
on preparing the Report on New Systems contained in the OMB 
Privacy Act Guidelines dated July 1, 1975 (Federal Register, 
July 9, 1975, p. 28977). 


- Reporting requirements. 
a. A Report on New Systems must be submitted when: 


(1) A new system of of personal records subject to the 
Privacy Act is propose A new system of records subject to... 
the new system x eporting requirement. is one for which no 
public notice consistent with the provisions of subsection 
(e) (4) is currently published in the Federal Register. 


t£ a public notice for any specific system of xecords is 
withdrawn, suspended, cancelled, or terminated and 
subsequently reinstated, the subject system of records shall 
be considered a new system and subject to the new system 
reporting requirement at such time that it is reinstated. 


(2) A change to a system of personal ‘records 
subject to the Privacy Act AcE is roposed. A new system report 


is required for any change to an existing system which meets 
any of the following criteria. 
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-Of the population covered; e.g., a system which only covere 
a oortion of the work force is expenced to cover all,. 13. 
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-(a) Increase or change the number or types of 
individuals on whom _records ara Maintained. Changes 
iavolying the number {rather than the types) of .individuals 
aoouk whom records are Kept need only be raported when thnak 
change significantly alters the cauaracter and purpose of the 


System of records, «.g., normal increases in historical 
files or other increases in the number of records in a file- 
whicn can be attributed to normal growth matterns nesd non. 


be reported. A change resulting from a change in the svope 


[om 


required to be reported. 


(b) Exoand the type or categorias ox 

ntormation maintained. For example, if an employee payroll 
file is expanded to include data on education and training, 
this would be considered an expansion of the "type. or 
categories of information" maintained, and would have to be 
reported. 


(c) Alter the manner in which the records ara 


“organized or the manner in which the records are indexed. or. 
retrieved so as to change the nature or scope of those 


records. For example, the combining of two or more existing 
systems or splitting an existing SYS tem into two or more 
different systems such as might occur in a centralization or 


(a4) Alter the purposes for which the 


information is used. For example, a proposal that files 


currently used as historical military service records are: to 


ba used. for making determinations on eligibility fox 
disability benefits would require a report. A proposal to 
establish or change the "routine uses" of the system will 
not require the submission of a Report on New System if such 


use is compatible with the purposes for which the system is 


maintained; i.e., does not, in effect, create a new purpose. 
Any new or changed "routine use" would, however, be subject 
to the requirements to give 30 days prior notice of such 
change in the Federal Register (5 U.S.C. 552a(e)(11)). 


(e) Change the equipment configuration (i.e., 
hardware and/or software) on which the system is operated so 


as to create the potential for either greater or easier 
access. For example, the addition of a telecommunications 
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Capability which could increase the risk of unauthorized 
access would require a reporc, 


be Coatenc. 92 tne: Resort, The agency wasort on 


shall consist of a brier narrative description, supporting 
documentation and an update of the inventory «of Federal 
personal data systems as outlined below: 


SS & 
rf 


(7) Narrative Statement ~ A briet statement, 


normally not to exceed four pages in length, which: 


= describes the purposes of the system of 
records. 


—— identifies the authority under which the 


system of records is to be maintained. | 


- provides the agency's evaluation of "the. 


probable or potential effect of such proposal on the privacy 
and other personal or property rights of individuals or the 
disclosure of information relating to such individuals and 


its effect on the preservation of the constitutional 


principle of federalism and separation of power,” and 


“ provides a brief description of steps 
taken by the agency to minimize the risk of unauthorized 


access to the system of records including a discussion of. 


higher or lower risk alternatives which were considered for 
meeting. the requirements of the system. A more detailed 
assessment of .the risks and specific administrative, 


technical, procedural, and vnysical safeguards established. 


shall.be.available on request. 

The narrative statement — should make yeference, as 
appropriate, to information in the supporting documentation 
rather than restate such information. 


Where changes to computer installations, communications 
networks, or any other general changes in information 
collection, handling, storage or dissemination are made 
which affect multiple systems of records; a single 
consolidated new system report may be submitted. In such 
cases, the narrative statement should address the overall 
privacy implications of the proposed change, identify all 
systems of records affected by the change and briefly 
describe any unique impacts on any specific system of 
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records. ' Supporting documentation, as defined in the 
subsequent paragraphs, shall be provided for eacn system of 
records. 


(2) . Supporting Documentation - The “‘Eollowing shall 
be appended to ala new system VSeoorcts: 


(a) An advance copy of the new or cevised: 


Se aaa RTT aa —— 
system notice ‘consistent with she provisions 


or 
ate) (BY) which the agency proposes to publish for che new | 


or altered system(s). For proposed alterations of existing 
systems the documentation shouid be provided in the same 
Form as the agency proposes to publish the public notice of 
such changes. iz the agency proposes to publish changes in 
the form of a revision to the public notice, a copy of the 
proposed notices of revision should be provided. If the 
agency plans ‘to supersede the entire existing notice, 
changes from the currently published notice shall he 
highlighted by underlining all new or revised portions. 


2 ae aches 1 b) An advance cop py of any new rules or. 
changes to ublished rules (consistent with the provisions” 


of 5 U.S.cG. 552a(e) (11) and (f£)) which the agency proposes 
to issue for the new or altered system. If no change -:to 


existing rules are required for the proposed new or altered 
system, the report shall so state. Proposed changes to_ 
existing rules shall be provided in. a Manner Similar to. aoe e 
Pees for the system notices. 2 ae 


(c) An eevee coo Dy of any Greeeeca: suas 
: setting forth the - reasons why che system is to ba exempted 


from a any ‘specific provision, ~ (consistent with the “provisions 


~~ of 5 UlS.C. 552a(j) or (k)) if the agency: head plans to: : 


invoke any exemptions for the new or altered systems. “4 


(3) Update of Federal Inventory of Personal Data 


Systems ~ OMB in cooperation with the National Archives and 


Records Service is developing a perpetual inventory of all 
systems of records subject to the Act. The detailed plans 
for this inventory are still being developed. It is 
anticipated, however, that agencies will be requested to 
provide a simple report to facilitate maintenance of the 
Federal inventory. This portion of the report on new 


systems is not in effect until such time as further 


instructions are issued. 
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c. Report Format. 


{1} Narrative Statement. No standard format has 
been established for the narrative statement. Agencies 
should prasant the information requested in the most concise 
fashion possible. 


{2) Su upporting DocumeneabTe!. The format of the 
documentation shall, wher applicable, be consistent with 
the publication Pode eaneies astablished by the Office of 
the Federal Register of the General Services Administration, 


(3) Update of Federal Inventory of Personal Data 


Systems. Format being developed. 


a. Distribution of Report. Two copies of each new 
systems report shall be suomitted to each of the following: 


(1) Speaker of the House. 

(2) President of the Senate. 

(3) The Privacy Protection Study Commission during 
the period of its existence as set forth in Section 5(g) of 
the Privacy Act. 


(4) Office.of Management and. Budget... 


e. Timing. A report on a proposed new or altered 
‘system of records shall be submitted no later than the 


following dates, whichever is earlier: 


(7) Sixty (60) days before: any issuance of data 


collection forms and/or instructions; or 

(2) Sixty (60) days before any public issuance of a 
Request for Proposal or an invitation to Bid for computer 
and/or communications systems or services intended to 
EMPPOES the system of records. 


3. Effective Date. The provisions of this Transmittal 
Memorandum are effective upon issuance. 
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4. Inquiries. M™quiries © concerning this °Transmittal 
Mamorandum may >e addressed to the Information Systems 
Division, Office of Management and. Budgat, Room’'20092, NEOB, 
Washington, D.C. 20503, telephone 292 295-4874. 
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